theodi/uk-postcodes — pull request #10 by cblanc (2014-01-09 13:13:49+00:00)
Title: Obfuscates production secret_token by moving to ENV variable. Fixes #9

My proposed fix to hide secret_token by default in production. [Taken from this blog post here](http://daniel.fone.net.nz/blog/2013/05/20/a-better-way-to-manage-the-rails-secret-token/)

I'd also recommend adding the Dotenv gem to more easily manage ENV in production. Setting the secret_token in production would be a simple matter of creating a `.env` file (not in version control) in `RAILS_ROOT` and appending it with the secret token e.g.

```
SECRET_TOKEN=randomstring....
```